wannacry | cdae3a72c15f823278b8564ceba56ce6b57280fc047a4c2ddc7cd6e226cf019f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe
Size

5.0MB
MD5

e16768cff1f6a540d7a08cd2abbb1d39
SHA1

8af96dc447d5ceeba6588b25b73da141ff579493
SHA256

cdae3a72c15f823278b8564ceba56ce6b57280fc047a4c2ddc7cd6e226cf019f
SHA512

1ce75c55c9af386aaf7d1da19edb9526aa2f5744d6dda9d01badcf47f05d20a8ed45c1ddeb19afc6f967a9da61e9c9c74beeeb5c27deab65c8ad2a4de14e9720
SSDEEP

49152:XnjQqMSPbcBVQej/VINRx+TSqTdX1HkQo6SAARdhnv:X8qPoBhzVaRxcSUDk36SAEdhv

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3357) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3516	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4588
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3516

C:\Users\Admin\AppData\Local\Temp\2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-11-27_e16768cff1f6a540d7a08cd2abbb1d39_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
4ac5975180b049002e516708b2d1868b

SHA1
052209268f5871fbe2f732dcd688c112129af2f0

SHA256
6fa0c5764a8f61c5187dd34609b1a89fb90c4cf5d223e77381b58d28a1824d3b

SHA512
29f58efbe8ef15d0a4e9f620a73826a4b82f9844b9099903a38038765928c8a704bc2597ac406d48b50330d20862f8cf443ed64f38163eeb205373b52d3d729b

Download Submit